1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
Size

4.4MB
MD5

c96e728ba7febe27e85b9acc04ddbf2c
SHA1

de8c3ff03cdf8a32bdb16fdaaaeff4b68fab72a0
SHA256

1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308
SHA512

f7606c02954b87b964cbd1aa208330fdc0af42e959d30fe64bf908647fb3efa241dd94b534ec4bd1f4a3fb07ba086702dfbbb96fc6b4d4e2032d56df27f25bc3
SSDEEP

98304:AyJOZ0Fb32Sh4H8U5I49z0Uwk3kqXf0FF5v:AyEZMhmPI49d13kSIFF

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1460	1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
1460	1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
1460	1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe

C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
"C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.core.dll

Filesize
538KB

MD5
f1dac51a74f4799838be29934a288c5c

SHA1
1e3ef5deb4e3f7a01656fbc3b7833276c3297a2f

SHA256
a7baa548c354ef9223f4fd19d2bae33c3eb8cb987bf7b577828897388110740f

SHA512
7d2a9f31d41a5f81cadf55961bf7fcc9eaa64393427e530303bc966088978cf28b22a186cb82ba251d82d210a4bd37c753f11e058209ea0e26dd2af91e1db5ab

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.wpf.dll

Filesize
46KB

MD5
9022d0f3e7b23ac1525b01d339582bd8

SHA1
97919a2bf43a7f3ada9fecb1fc9e6d5cc673f46c

SHA256
ba0de999989a0cc45e5650503d4755bb9ff56e922741d1724747147811657c5d

SHA512
82c2e5f68a39906c1b5a29d22544a0545cb51793edcd6b4326f37dbc5dc61fb5d8f848937a6dea4b66594a4c38f3d6974ecda5be7fbd6dad947e936dab7d9dd5

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\webview2loader.dll

Filesize
113KB

MD5
80243b7f55a36f54b0c1c3735e883861

SHA1
06800e33619b24c60292aab984df47489ce4d64b

SHA256
7cddfcd327290d5f1b997ea9636a4595b5188c8a5ab495a4251bad46709a0c62

SHA512
06dd2a24e898d11dbf3b03df208ac9822e4ccadd6a38c424b17ed94cb00b1372ba5794fe4fa93ddf7175455c950301c0bcb3134748d5494f089d01fe8c68ba07

Download Submit
memory/1460-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1460-1-0x0000000000270000-0x00000000006DC000-memory.dmp

Filesize
4.4MB

Download
memory/1460-13-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1460-14-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1460-15-0x0000000005820000-0x0000000005B8C000-memory.dmp

Filesize
3.4MB

Download
memory/1460-16-0x0000000000BC0000-0x0000000000BFE000-memory.dmp

Filesize
248KB

Download
memory/1460-17-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1460-18-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads